LiveActive security incident?Get immediate response
CVE Record

CVE-2021-36721: Sysaid - Sysaid API User Enumeration

Sysaid API User Enumeration - Attacker sending requests to specific api path without any authorization before 21.3.60 version could get users names from the LDAP server.

MediumCVSS 4.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-36721 is a SysAid API user-enumeration issue. In affected versions before 21.3.60, an unauthenticated attacker could obtain user names from an LDAP server through a specific API path. This is mainly a confidentiality and follow-on risk issue, not a full system compromise by itself.

Executive priority

Treat as a moderate-priority information-disclosure risk. It can expose employee account names that support phishing, password attacks, or social engineering. Prioritize systems with LDAP integration or broad API reachability, but do not treat it as confirmed active exploitation from the supplied evidence.

Technical view

The source bundle describes unauthenticated access to a SysAid API path that can disclose LDAP user names. CVSS 3.1 is 4.4 medium with local attack vector, low complexity, no privileges, required user interaction, and low confidentiality and integrity impact. Available sources do not define CWE, exploit details, or complete product/version scope.

Likely exposure

Exposure is most likely where SysAid API versions before 21.3.60 are deployed with LDAP integration. The bundle specifically names SysAid 20.4.74, but the description says before 21.3.60. Internet exposure, required locality, and deployment prerequisites are not fully evidenced in the provided sources.

Exploitation context

No cited source states active exploitation, and the bundle marks KEV as false. The available evidence supports user enumeration through unauthenticated API requests, but does not support claims of public exploitation, broad scanning, or direct remote code execution.

Researcher notes

Key uncertainty is scope: the affected record names SysAid API and version 20.4.74, while the description says before 21.3.60. The CVSS vector lists local attack vector and user interaction, which should be reconciled with deployment architecture before risk scoring internally.

Mitigation direction

  • Verify SysAid version and compare it against 21.3.60 vendor guidance.
  • Update affected SysAid deployments according to SysAid or INCD advisory instructions.
  • Restrict SysAid API access to trusted networks and authenticated administrative paths.
  • Review LDAP exposure and minimize disclosed directory attributes where possible.
  • Monitor SysAid API logs for unauthenticated user-enumeration patterns.

Validation and detection

  • Inventory all SysAid instances and confirm exact product versions.
  • Confirm whether LDAP integration is enabled on each instance.
  • Check whether SysAid API endpoints are reachable by untrusted users.
  • Review logs for unauthenticated API access around user or directory lookup activity.
  • Validate remediation using vendor-supported checks, not exploit reproduction.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-36721 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4.4CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N1.82.5Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

4.4Medium
CVSS 3.1 vector shape for CVE-2021-36721Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
SysAidSysAid APISysaid – version 20.4.74 20.4.74Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.